“We passed the audit” is one of the most reassuring statements in cybersecurity, and one of the most misleading. Compliance and security are closely related, but they are not equivalent. Understanding the distinction allows an organisation to derive genuine value from both.
What compliance measures
A standard or regulation sets out the controls that a competent organisation is expected to have in place. An audit verifies that those controls exist, at a point in time, against a sample of evidence. That has real value: it imposes discipline, establishes a common language with regulators and customers, and exposes gaps that might otherwise persist for years.
An audit, however, has inherent limits. It confirms that a firewall policy is documented and periodically reviewed, not that every rule remains justified. It confirms that access reviews took place, not that a shared engineering account on the plant floor has been retired. It assesses the controls the standard prescribes, not the threats specific to the organisation.
How the gap arises
- Point-in-time assessment. Systems change continuously while audits are periodic. A control in place during fieldwork may be bypassed by a temporary change months later.
- Design versus operating effectiveness. A well-written procedure may never be followed. Evidence of the document is not evidence of the practice.
- Scope limitations. Certification frequently covers only part of an organisation, while attackers are not constrained by scope statements.
- Checkbox compliance. When the objective is to pass, teams implement the minimum control that satisfies the requirement rather than the control that most reduces risk.
Why compliance remains worth doing well
None of this diminishes the value of compliance. Frameworks such as ISO/IEC 27001, the NIST Cybersecurity Framework, IEC 62443 for industrial automation and control systems, and national regulatory frameworks codify a substantial body of industry experience. Applied properly, they provide a strong baseline and a structure for continual improvement.
The key is to treat the framework as a minimum rather than a ceiling, and to drive the program from risk rather than from the audit calendar.
Aligning compliance and security
- Start from risk. Use the risk register to determine which controls must be strongest, then map them to the framework, rather than the reverse.
- Assess once, report against many. Many organisations answer to several standards. Mapping them to a common control set allows a single assessment to generate evidence for all of them.
- Collect evidence continuously. Capture evidence as controls operate, not in the weeks before an audit, so gaps surface while there is time to address them.
- Test operating effectiveness. Penetration testing, tabletop exercises and configuration reviews demonstrate whether a control performs, which an audit sample cannot.
- Track nonconformities. Any control rated “not implemented” or “partially implemented” should generate a remediation action with an owner and a target date.
Compliance confirms that appropriate controls exist. Security is whether those controls withstand a determined adversary on an ordinary working day. Both are required, and the most mature organisations treat the former as evidence of the latter.